New ClickLock macOS Malware Traps Users Into Revealing Login Password

Overview

Security researchers at Group-IB have disclosed ClickLock, a macOS information-stealing malware with a particularly aggressive coercion mechanism: it kills every visible application on the system every 210 milliseconds for up to 300,000 seconds (83 hours), leaving only a fake password dialog — and persists through reboots until the victim surrenders their credentials.

The malware was first submitted to VirusTotal on June 9, 2026, and was undetected by every vendor at the time of disclosure. At least 100 victims across 33 countries had already been compromised, with more than half in Europe.

Infection Chain: ClickFix Lure

ClickLock uses a ClickFix social engineering lure — a fake Cloudflare "human verification" page that instructs the user to paste a terminal command. No exploits or elevated privileges are required.

Fake Cloudflare page
    → Victim pastes terminal command
    → Shell script hides cursor + plays animated "progress bar"
    → Downloads 4 malware modules from compromised WordPress sites

The shell script creates a seamless fake verification experience before any malicious behavior becomes visible.

The Coercion Mechanism

Stage 1 — Fake password dialog

The script first presents a convincing fake macOS password prompt using the victim's real username and a downloaded Apple icon. If the victim enters their password, it is immediately sent to a Telegram Bot API endpoint and the attack is complete.

Stage 2 — Kill loop (if victim refuses)

If the victim cancels or closes the dialog, ClickLock installs two LaunchAgent persistence entries:

On next activation, a kill loop fires every 210ms, terminating:

• Finder
• Dock
• Terminal
• Activity Monitor
• Console
• System Settings
• Spotlight
• All web browsers

The loop runs for 300,000 seconds (~83 hours / ~3.5 days), survives reboots, and leaves only the fake password dialog visible. The victim's only apparent escape is entering their password or powering off the machine.

What ClickLock Steals

Once credentials are obtained, ClickLock harvests an extensive set of data:

All harvested data is ZIP-archived and exfiltrated via the Telegram Bot API. Files over 40 MB are split into chunks. Most harvesting modules self-delete after exfiltration.

Persistent Backdoor: GSocket

After all data harvesting modules self-delete, ClickLock installs a modified version of the open-source GSocket tool as a persistent backdoor. It masquerades under an iCloud-like name and achieves persistence through:

• LaunchAgent
• Crontab entry
• Shell configuration modification (.zshrc, .bash_profile)

This means the attacker retains remote access to the compromised machine long after the initial credential theft — even if the victim changes their password afterward.

Detection Signals

Campaign Statistics

Defensive Recommendations

1. Never paste terminal commands from web pages — this is the ClickFix vector and has no legitimate use case from browser prompts
2. Enable Gatekeeper and System Integrity Protection — ensure macOS security layers are not disabled
3. Monitor LaunchAgents — unexpected entries in ~/Library/LaunchAgents/ warrant investigation
4. Block outbound Telegram Bot API traffic at the network level for endpoints that have no business reason to use it
5. Check for GSocket — search for GSocket binaries (/usr/local/bin/gsocket, ~/Library/) with unusual names
6. Reset credentials immediately if compromise is suspected — the attacker likely has keychain access

Sources

• Group-IB — ClickLock Stealer: Paste Once, Lose Everything
• BleepingComputer — New ClickLock macOS malware traps users into revealing login password
• The Hacker News — New ClickLock macOS Stealer Kills Apps Every 210ms

Related Reading

• Claude AI Artifacts Abused to Distribute macOS Infostealer
• ZeroDayRAT Mobile Spyware Targets iOS and Android